Agentic Filesystem MCP
Agentic Filesystem MCP Server
Agentic Filesystem MCP Server is a secure, highly capable Model Context Protocol (MCP) server written in Rust. It exposes a comprehensive suite of filesystem operations as tools for AI agents.
Built with security and AI-context limits in mind, it utilizes capability-based security to strictly sandbox operations to allowed directories and includes built-in pagination, line-numbering, and search features to optimize LLM token usage.
π Key Features
Secure by Default: Uses cap-std to sandbox all filesystem access. Agents cannot traverse outside the explicitly provided root directories, preventing path traversal vulnerabilities.
LLM-Optimized: Features like pagination (
limit/offset), exact string replacement (edit), and line numbering prevent context window overflow when working with large files or directories.Smart Searching: Both
grepandglobtools natively respect.gitignorefiles and hidden directories.Media Support: Seamlessly handles both text and media files.
Related MCP server: Filesystem MCP Server
π¬ Demo
https://github.com/user-attachments/assets/d573ffe7-0038-439a-89a0-4742408da15f
π¦ Installation
Download the latest release from Releases.
π οΈ Usage
Start the server by providing the root directory or mount points you want the agent to have access to.
agentic-filesystem-mcp [OPTIONS]Options:
--root <ROOT_PATH>: A single root path the server will serve and sandbox. Mutually exclusive with--mount.--mount <MOUNT_POINT> <ROOT_PATH>: One or more mount points, each mapping a virtual path to a root directory. Can be specified multiple times. Mutually exclusive with--root.
Path Resolution Examples
Using --root
The --root option sets a single directory as the root of the server. The agent accesses files directly via their relative paths within this directory. You can also use relative paths, such as ., to serve your current working directory.
Example: Serving the current directory
agentic-filesystem-mcp --root .If your current directory contains main.py and src/index.ts, the agent accesses them as:
main.pysrc/index.ts
Example: Serving an absolute path
agentic-filesystem-mcp --root /var/www/my-appIf /var/www/my-app contains app.js and components/Button.tsx, they are accessible as:
app.jscomponents/Button.tsx
Using --mount
The --mount option maps physical directories to virtual mount points, allowing you to securely expose multiple distinct directories to the agent at once.
Example: Multiple distinct mounts
agentic-filesystem-mcp --mount frontend /var/www/react-app --mount backend /opt/api-serverIf /var/www/react-app contains package.json and /opt/api-server contains main.py, the agent accesses them as:
frontend/package.jsonbackend/main.py
Example: Nested mount points
You can specify highly nested virtual paths as mount points and safely overlap them to build complex, unified virtual file trees.
agentic-filesystem-mcp \
--mount workspaces/frontend /home/user/projects/web \
--mount workspaces/backend/main-api /home/user/projects/server \
--mount workspaces/backend/worker /home/user/projects/cronIn this example, the agent sees a single virtual workspaces directory and accesses the files like this:
workspaces/frontend/index.htmlworkspaces/backend/main-api/app.pyworkspaces/backend/worker/tasks.py
Tools
read
Reads the contents of a file. Supports text files and media files
Inputs:
path(string): File locationtype(string): The type of content to read.textfor text files,mediafor media fileslimit(number, optional, default: 100): Maximum number of lines to read, for text filesoffset(number, optional, default: 0): Number of lines to skip before reading, for text filesshow_line_numbers(boolean, optional, default: true): Whether to prepend 1-indexed line numbers, for text files
write
Creates new file or overwrites existing
Inputs:
path(string): File locationcontent(string): The complete content to write to the file
Auto-creates parent directories β any missing intermediate directories in the path are created
edit
Make selective edits using exact string replacement
Inputs:
path(string): File locationold_string(string): Text to search for (must match exactly including whitespace)new_string(string): Text to replace withreplace_all(boolean, optional, default: false): Whether to replace all occurrences
If
replace_allisfalse/omitted andold_stringmatches more than once, the tool fails without making any changes
grep
Search file contents using regular expressions
Inputs:
pattern(string): The regex pattern to search forpath(string, optional, default: "."): Directory or file to search inglob(string, optional): Glob pattern to filter files (e.g.,*.{ts,tsx})output_mode(string, optional, default:content): One ofcontent,files_with_matches,countbefore_context(number, optional, default: 0): Lines before each match (requires output_mode=content)after_context(number, optional, default: 0): Lines after each match (requires output_mode=content)limit(number, optional, default: 100): Maximum number of lines to returnoffset(number, optional, default: 0): Number of lines to skipmultiline(boolean, optional, default: false): Enable multiline modeshow_line_numbers(boolean, optional, default: true): Show line numbers (requires output_mode=content)
Results are ordered by file modification time
Natively respects
.gitignorerules and hidden files/directoriesBinary files are skipped
glob
Search for files or directories matching a glob pattern
Inputs:
pattern(string): Glob pattern to match (e.g.,*.{ts,tsx})path(string, optional, default: "."): Directory to search inlimit(number, optional, default: 100): Maximum number of resultsoffset(number, optional, default: 0): Number of results to skip
Results are sorted by modification time
Natively respects
.gitignorerules and hidden files/directories
mkdir
Create new directory or ensure it exists
Inputs:
path(string): Directory locationparents(boolean, optional, default: false): Create parent directories as needed (equivalent tomkdir -p). Iftrue, no error is returned if the directory already exists
move
Move or rename files and directories
Inputs:
src_path(string): Source pathdst_path(string): Destination path (must include the target file/directory name, not just the destination folder)
Overwrites an existing destination of the same name if it exists
copy
Copy a file or directory to a new location
Inputs:
src_path(string): Source pathdst_path(string): Destination path (must include the target file/directory name, not just the destination folder)recursive(boolean, optional, default: false): MUST be set totruewhen copying a directory, otherwise the operation will fail
Fails if the destination path already exists
File copies preserve the source file's permissions
Recursive copies preserve the directory tree, file and directory permissions, and symlinks
remove
Remove a file or directory
Inputs:
path(string): Path to the file or directory to removerecursive(boolean, optional, default: false): MUST be set totrueto remove a non-empty directory
stat
Get information about a file or directory
Inputs:
path(string): The path of the file or directory to get information about
Includes file type, size, creation time, modification time, access time, and permissions
Reports symlinks without following them
Usage with Claude Desktop
Add this to your claude_desktop_config.json:
{
"mcpServers": {
"filesystem": {
"command": "/path/to/agentic-filesystem-mcp",
"args": [
"--root",
"/path/to/my/favorite/directory"
]
}
}
}Usage with VS Code
Add this to your mcp.json:
{
"servers": {
"filesystem": {
"command": "/path/to/agentic-filesystem-mcp",
"args": [
"--root",
"/path/to/my/favorite/directory"
]
}
}
}π Security Architecture
This server relies heavily on cap_std::fs::Dir. Root directories are opened as "ambient directories" and all subsequent tool executions are mapped to these capability objects.
If an agent attempts to access /etc/passwd or ../../../../ssh/id_rsa while the server was restricted to ./my_project, the operation will fail at the sandbox level. Symlinks are safely evaluated and resolved relative by the sandbox.
π License
This project is released under the MIT License.
Available Tools
10 toolscopyB
Copies a file or directory to a new location.
IMPORTANT: This operation fails if the destination path already exists.
| Name | Required | Description | Default |
|---|---|---|---|
| dst_path | Yes | The destination path. IMPORTANT: This must include the target file or directory name, not just the destination folder. | |
| src_path | Yes | The source path to the file or directory to copy. | |
| recursive | No | Whether to recursively copy a directory and its contents. IMPORTANT: This MUST be set to `true` when copying a directory, otherwise the operation will fail. Defaults to `false` if not specified. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the behavioral burden; it does disclose a critical nontrivial trait ('operation fails if the destination path already exists'), which is genuinely valuable for an agent. However, it leaves other behaviors undisclosed, such as whether intermediate directories are created, what the call returns on success, and whether source metadata/permissions are preserved.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with zero waste: the first states the purpose, and the second front-loads a critical failure condition with an IMPORTANT marker. Every sentence earns its place and the most decision-relevant constraint is highly visible.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description could reasonably explain what a successful copy returns or confirms, but does not. The critical correctness details (recursive requirement, destination naming, failure-on-existing) are covered across the description and full-coverage schema, leaving only minor edge-behavior gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline of 3 applies; the description itself adds no parameter-level detail. The schema already documents the important constraints (dst_path must include the target name, recursive must be true for directories), so no compensation is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Copies') and resource ('file or directory to a new location'), making the core purpose immediately clear. It differentiates from the closest sibling `move` through the verb itself, but does not explicitly name or contrast against `move` or `write`, so it falls short of the strongest sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use `copy` versus its most similar sibling `move` (e.g., use copy when the original must be preserved, move when it should be relocated), nor does it mention any alternatives for file creation like `write`. The only guidance present is operational (fails if destination exists), not usage routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
editA
Performs exact string replacement in a file. Useful for making partial changes to an existing file.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | The path to the file to edit. | |
| new_string | Yes | The text to replace it with. This will be inserted exactly as provided. | |
| old_string | Yes | The exact text to replace. IMPORTANT: This must match the file contents exactly, including all indentation, newlines, and whitespace. If you previously read the file with line numbers, you must strip them before matching. | |
| replace_all | No | Whether to replace all occurrences. Set to `true` to replace every instance instead. IMPORTANT: If `false` or omitted, the edit will fail if `old_string` appears more than once in the file. Defaults to `false` if not specified. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of explaining behavior, and it does convey exact matching and modification of an existing file. It does not mention the failure on multiple matches or the replace_all default, though the parameter descriptions do cover those details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler. The core action is front-loaded and the usage context is presented efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has four parameters, complete schema descriptions, and no output schema. The description plus schema give an agent enough to call the tool correctly, though a brief behavioral warning about multiple matches would make it fully self-contained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The parameter descriptions already explain exact whitespace matching, line-number stripping, and replace_all behavior, so the main description does not need to add parameter-level detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb, resource, and mechanism: exact string replacement in a file. It also clarifies that the tool is for partial changes, which distinguishes it from siblings like write and remove.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Useful for making partial changes to an existing file' gives clear context for when to use the tool, and implies it is not for full-file writes. However, it does not explicitly name alternatives or exclusion cases, so it stops short of full guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
globA
Searches for files or directories matching a glob pattern and returns them sorted by modification time.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | The directory to search in. Defaults to empty if not specified. | |
| limit | No | The maximum number of results to return. Useful for preventing token overflow when a pattern matches thousands of files. Defaults to `100` if not specified. | |
| offset | No | The number of results to skip. Used in combination with limit to paginate through large sets of matching files. Defaults to `0` if not specified. | |
| pattern | Yes | The glob pattern to match. IMPORTANT: Patterns like `*.ts` or `src/*.rs` are automatically recursive in this tool. To search ONLY the top-level directory, you MUST use a leading slash (e.g., `/*.ts` or `/src/*.rs`). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the search and sorting behavior, but omits the key fact that patterns are recursive by default (only documented in the schema). It also doesn't mention that it's a read-only operation, though that is implied. The recursion behavior is a significant surprise that should be highlighted.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with zero waste. It starts with the verb and resource and includes the key behavior (sorting). Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 4 parameters and no annotations, the description is adequate but misses the default recursive pattern behavior, which is a critical invocation detail. It also doesn't hint at pagination or token-overflow concerns, though those are covered in the schema. It's not incomplete enough to be a 2, but it leaves room for more.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all parameters are well-documented in the schema. The tool description adds no additional parameter meaning beyond what the schema already provides, meeting the baseline for high coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb (searches), resource (files or directories), and a distinguishing behavior (sorted by modification time). It is specific enough to differentiate from sibling tools like grep (content search) and read/write operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description conveys clear context for what the tool does but does not explicitly mention when to use it versus alternatives or provide exclusions. An agent can infer it's for path-pattern discovery, but there's no explicit routing like 'use grep for content search'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
grepB
Searches file contents using regular expressions.
| Name | Required | Description | Default |
|---|---|---|---|
| glob | No | The glob pattern to filter files to be searched (e.g., `*.{ts,tsx}` or `src/**/*.rs`). Extremely useful for narrowing down searches and improving speed. Defaults to `null` if not specified. | |
| path | No | The directory or file to search in. Defaults to empty if not specified. | |
| limit | No | The maximum number of lines to return. Useful for preventing token overflow when a pattern matches thousands of files/lines. Defaults to `100` if not specified. | |
| offset | No | The number of lines to skip. Used in combination with limit to paginate through large sets of matching lines. Defaults to `0` if not specified. | |
| pattern | Yes | The regular expression pattern to search for in file contents. Uses standard regex syntax. IMPORTANT: Remember to escape literal characters (e.g., `interface\{`). | |
| multiline | No | Whether to enable multiline mode where `.` matches newlines, `^` and `$` match line boundaries, and patterns can span multiple lines. Defaults to `false` if not specified. | |
| output_mode | No | The output mode: `content` (matching lines), `files_with_matches` (paths only), or `count` (match counts per file). Defaults to `content` if not specified. | |
| after_context | No | The number of lines to show after each match to provide context. Requires `output_mode` to be `content` or omitted. Ignored otherwise. Defaults to `0` if not specified. | |
| before_context | No | The number of lines to show before each match to provide context. Requires `output_mode` to be `content` or omitted. Ignored otherwise. Defaults to `0` if not specified. | |
| show_line_numbers | No | Whether to show line numbers in the output. Requires `output_mode` to be `content` or omitted. Ignored otherwise. Defaults to `true` if not specified. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden of behavioral disclosure. It only states that the tool searches, but does not disclose that it is read-only, what output format to expect, or any side effects. This is a notable gap for a tool with no output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no filler. It front-loads the core purpose and method, making it easy to parse quickly. Every word adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 10 parameters, no output schema, and no annotations, the description is incomplete. It does not explain return values, line formatting, or why an agent should choose this over read or glob. The schema compensates for parameters, but the behavioral and output context is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameters are fully documented in the schema. The description adds no additional parameter semantics, and the baseline of 3 is appropriate since the schema already handles the definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Searches'), resource ('file contents'), and method ('using regular expressions'). This clearly differentiates grep from sibling tools like read (reading full contents) and glob (matching file paths).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use grep versus alternatives. The description does not mention conditions, exclusions, or sibling tools such as read or glob. An agent must infer usage solely from the purpose statement, which is not enough for clear tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mkdirA
Creates a new directory.
IMPORTANT: The write tool automatically creates missing parent directories. You DO NOT need to call mkdir prior to writing a new file with the write tool.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | The path to the directory to create. | |
| parents | No | Whether to create parent directories as needed (equivalent to `mkdir -p`). If `true`, no error is thrown if the directory already exists. Defaults to `false` if not specified. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states the basic action of creating a directory and mentions the write tool's behavior, but does not disclose error conditions (e.g., what happens if the directory exists when parents is false), permission requirements, or return behavior. This is a significant gap for a tool with no annotation support.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely conciseβtwo sentences, with the primary purpose front-loaded and the important usage note following. Every sentence earns its place, with no waste. It is appropriately sized for a simple tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool, the description is fairly complete. It covers the core action and includes a valuable note about the write tool's behavior to avoid redundancy. However, it omits details about error handling (e.g., behavior when the directory already exists) and does not describe return values, though the schema partially covers error behavior via the 'parents' flag. Overall, it is adequate for typical usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage for both parameters, including default behavior for 'parents'. The description adds no additional parameter semantics beyond what the schema already provides. The baseline of 3 applies because the schema fully documents the parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb and resource: 'Creates a new directory.' It is specific and unambiguous, distinguishing itself from siblings like write, read, and remove by its directory-focused action. However, it does not explicitly contrast itself with sibling tools beyond the write tool note, so it lacks full differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly tells agents when NOT to use mkdir: 'You DO NOT need to call mkdir prior to writing a new file with the write tool.' This is a strong usage exclusion that prevents unnecessary calls. It does not explicitly state when to use it, but the purpose is clear enough that usage is implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
moveB
Moves or renames a file or directory.
IMPORTANT: If the destination path already exists, it will be overwritten. Always verify the destination path before calling.
| Name | Required | Description | Default |
|---|---|---|---|
| dst_path | Yes | The destination path. IMPORTANT: This must include the target file or directory name, not just the destination folder. | |
| src_path | Yes | The source path to the file or directory to move or rename. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of disclosing behavioral traits. It does warn that an existing destination will be overwritten, which is a critical destructive behavior. However, it does not disclose other relevant behaviors such as what happens on failure, whether it returns anything, permission requirements, or whether moving a directory moves its contents recursively. The overwrite warning is valuable but the disclosure is incomplete for a mutation tool without annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two sentences. The first states the purpose directly, and the second highlights the critical overwrite warning, which is front-loaded and prominent. There is no fluff or redundant content, and every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (two parameters, no output schema, no annotations), the description covers the most essential safety aspect (overwrite) but lacks detail on return values, error handling, and edge cases like moving directories. For an agent to use it safely, the overwrite warning is key, but other aspects like what happens on success are unspecified. It is adequate but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage for both parameters. The src_path description is clear, and the dst_path description includes an important note about including the target name, which adds value beyond the schema. The tool description itself contributes no additional parameter information, so the baseline of 3 applies because the schema already handles semantics well.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Moves or renames a file or directory.' It clearly indicates the operation's scope and is distinct from siblings like copy (duplicates) and remove (deletes), though it does not explicitly name alternatives. The verb 'move' inherently differentiates it, but the description doesn't call out sibling distinctions, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no explicit guidance on when to use this tool versus alternatives. It does not mention 'use copy for duplication' or 'use remove for deletion,' nor does it specify any prerequisites or conditions. The only additional instruction is a caution to verify the destination path, which is not usage selection guidance. The intended use is implied by the verb but not stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
readB
Reads the contents of a file. Supports text files and media files.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | The path to the file to read. | |
| type | Yes | The type of content to read. `text` for text files, `media` for media files. | |
| limit | No | The maximum number of lines to read. Useful for preventing token overflow when reading very large text files. Ignored for media files. Defaults to `100` if not specified. | |
| offset | No | The number of lines to skip before starting to read. Used in combination with limit to paginate through large files. Ignored for media files. Defaults to `0` if not specified. | |
| show_line_numbers | No | Whether to prepend 1-indexed line numbers to each line (e.g., `1:`, `2:`). Setting this to `false` can save tokens when line numbers are strictly not needed. Ignored for media files. Defaults to `true` if not specified. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It states only the action and supported types, but does not disclose that read is non-destructive, whether it requires permissions, or how it handles large files or media output. The description adds no behavioral context beyond the basic action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise, with two short sentences. The first sentence states the core action; the second clarifies support for media files, which is non-obvious and adds value. It is front-loaded and efficient, though it could be slightly more informative without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the rich schema (100% parameter coverage) and no output schema, the description is adequate for basic understanding but lacks details on media file behavior and output format. The mention of 'media files' is ambiguousβdoes it return binary data or a preview? The description does not clarify, so completeness is only moderate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all parameters (path, type, limit, offset, show_line_numbers) are already well-documented. The description adds no parameter information beyond what the schema provides. Per the rubric, the baseline is 3 when schema covers all parameters, and the description does not improve on it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb ('Reads') and resource ('the contents of a file'), and the mention of text/media files distinguishes it from sibling tools like write, edit, and remove. The purpose is unambiguous and the agent can immediately infer this is a read operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives. It does not mention that grep is for searching content, or that read is for retrieving file contents, nor any exclusions or prerequisites. An agent is left to infer usage from the purpose alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
removeA
Removes a file or directory.
IMPORTANT: This action is permanent. Always verify the path before calling.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | The path to the file or directory to remove. | |
| recursive | No | Whether to recursively remove a directory and all its contents. IMPORTANT: This MUST be set to `true` to remove a non-empty directory. Defaults to `false` if not specified. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It explicitly warns that the action is permanent and instructs verifying the path, which is critical behavioral context for a destructive operation. It also notes that recursive must be true for non-empty directories, which is a key behavioral constraint. However, it doesn't mention what happens on failure (e.g., missing path) or whether it returns any confirmation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with zero waste. The core action is front-loaded, and the critical warning is placed immediately after. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive tool with no annotations and no output schema, the description covers the essential safety context (permanence, path verification, recursive requirement). It doesn't describe return values, but the absence of an output schema lowers the bar. It could mention error behavior (e.g., what happens if the path doesn't exist), but the critical operational details are present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters. The description adds the critical warning that recursive MUST be true for non-empty directories, which reinforces the schema's own note. This adds some value beyond the schema, but the schema already covers the parameter meanings well, so a baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb ('Removes') and resource ('a file or directory'), which distinguishes it from siblings like copy, move, edit, and write. It doesn't explicitly name a sibling alternative, but the action is unambiguous and the scope is clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool (when you want to delete a file or directory) but doesn't explicitly contrast it with alternatives like move (which could relocate instead of delete) or provide conditions for when not to use it. The permanent-destruction warning serves as a caution but not a usage guideline.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
statA
Gets information about a file or directory, including its file type, size, creation time, modification time, access time, and permissions.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | The path of the file or directory to get information about. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It explicitly says 'Gets information' which implies a read-only operation, and it lists the returned fields. However, it does not mention error behavior (e.g., if the path does not exist), whether it follows symbolic links, or any permission requirements. It adds useful return-value context but stops short of deeper behavioral transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, tight sentence with no filler. The core purpose is front-loaded ('Gets information about a file or directory'), followed by a specific list of returned attributes. Every word earns its place, and it is appropriately sized for a simple tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is sufficiently complete for a one-parameter tool with no output schema. It enumerates the key data an agent would expect from a stat operation. It does not cover error cases or symlink behavior, but for a standard metadata retrieval tool, the provided list of return fields is adequate for an agent to know what to expect. Minor gaps exist, but they do not undermine usability.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema fully documents the sole parameter 'path' with a clear description. Since schema description coverage is 100%, the tool description adds no additional parameter semantics. The baseline of 3 applies because the schema already carries the load; the description does not need to compensate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it gets information about a file or directory and enumerates specific attributes (file type, size, times, permissions). This is a specific verb+resource that distinguishes it from siblings like read (content), write, edit, and remove. An agent can immediately understand what this tool does and how it differs from the rest.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance on when to use this tool versus alternatives. The description simply states its function without mentioning any prerequisites, exclusions, or scenarios where another tool would be more appropriate. The distinction from siblings is implied by its name and purpose, but not articulated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
writeA
Writes a file, automatically creating any missing parent directories. Completely overwrites the file if one already exists.
IMPORTANT: Because it overwrites entirely, ensure you have the complete file context before modifying existing files. For partial changes to existing files, prefer using the edit tool.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | The path to the file to write. | |
| content | Yes | The complete content to write to the file. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It clearly discloses the destructive overwrite behavior and the side effect of creating parent directories. It also adds a caution about data loss, which is valuable transparency beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely tight: the first sentence states the core action, the second clarifies overwrite behavior, and the final paragraph adds an important warning and sibling alternative. No word is wasted, and the key facts are front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter write tool with no output schema or annotations, the description covers the essential context: purpose, overwrite/destructive behavior, parent directory creation, and guidance for using the alternative `edit` tool. It doesn't detail error cases, but the information needed to invoke it correctly is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds meaning by stating that missing parent directories are automatically created (path behavior) and that content is the complete replacement, reinforcing that partial changes should go to `edit`. This goes beyond the schema's simple descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: it writes a file, automatically creates missing parent directories, and overwrites existing files. It explicitly distinguishes itself from the `edit` tool by directing partial changes elsewhere, so an agent can tell them apart immediately.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit when-not guidance: for partial changes to existing files, prefer the `edit` tool. It also warns to ensure complete file context before modifying existing files, which is a clear usage prerequisite.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
10 tool updates
- First observed
copy - First observed
edit - First observed
glob - First observed
grep - First observed
mkdir - First observed
move - First observed
read - First observed
remove - First observed
stat - First observed
write
TDQS
Scored across 10 tools
Each tool performs a uniquely identifiable filesystem operation with no overlap: remove, copy, edit, glob, grep, mkdir, move, read, stat, and write are clearly distinct. Even edit and write are differentiated by partial vs full overwrite, and move vs copy are precise.
All tool names are single lowercase imperative verbs (remove, copy, edit, etc.), forming a consistent pattern. Abbreviations like mkdir and stat are conventional and do not break the overall coherence.
Ten tools is well within the ideal 3β15 range and each tool serves a fundamental filesystem need. The scope is appropriate for a dedicated filesystem MCP server without bloat or redundancy.
The set covers the core lifecycle: read, write, edit, delete, copy, move, create directory, and stat. A dedicated directory listing tool is missing, but glob can substitute. Minor gap but manageable overall.
Maintenance
Related MCP Connectors
Nifty's MCP server β exposes tasks, projects, messages, and files as tools for AI agents.
Hosted MCP server connecting claude.ai, ChatGPT and other AI apps to your own computer
Cloud-hosted MCP server for durable AI memory
Agent-native MCP server over the public saagarpatel.dev corpus. Read-only, stateless.
Related MCP Servers
- AlicenseAqualityAmaintenanceNode.js server implementing Model Context Protocol (MCP) for filesystem operations.1014497,862 npm90,569-
- AlicenseNot gradedqualityFmaintenanceGo server implementing Model Context Protocol (MCP) for filesystem operations.690MIT
- AlicenseNot gradedqualityDmaintenanceA secure, production-grade MCP server that provides filesystem operations, AST math evaluation, and system diagnostics for LLM agents.MIT
- AlicenseNot gradedqualityCmaintenanceAn MCP server that gives AI agents file system access: read, write, search, hash, directory trees β 12 tools, zero dependencies, pure Python stdlib.MIT